Generate an RSA key pair for DKIM email signing. The public key goes into your DNS as a TXT record. Keep the private key on your mail server.
DKIM (DomainKeys Identified Mail) uses asymmetric cryptography to sign outgoing emails. Your mail server signs each message with the private key. Receiving servers verify the signature using the public key published in your DNS as a TXT record at selector._domainkey.yourdomain.com.
Choose 2048-bit keys as the minimum. 1024-bit is considered weak and is rejected by some receiving mail servers. 4096-bit provides maximum security at the cost of slightly larger DNS records and more CPU use per message. The selector can be any alphanumeric string - it lets you rotate keys by using a new selector while keeping the old one active during the transition.
After generating: (1) add the TXT record to your DNS, (2) install the private key PEM on your mail server, (3) configure your MTA (Postfix, Exim, or your ESP) to sign with the private key using the selector you chose. Verify the setup with the DKIM Checker.